Keeping Fertility Treatment Records Private

The gap people assume is not there

HIPAA governs health care providers, health plans and the clearinghouses between them. Your clinic is covered. The records your clinic holds are covered. A period or fertility app you downloaded yourself generally is not, because it is not a provider or a plan — it is a company selling software.

The rule that does reach these apps is the FTC's Health Breach Notification Rule, which applies specifically to health apps and similar technologies that are not covered by HIPAA. That rule exists precisely because the gap exists. It requires notification when identifiable health information is disclosed without authorization — which is a meaningful protection, but a different one from the confidentiality people imagine they already have.

What the enforcement record actually shows

This is not hypothetical. In 2021 the FTC finalized an order against Flo Health over its Period and Ovulation Tracker, alleging that despite privacy promises, the company disclosed health data from millions of users to firms providing marketing and analytics services, including the analytics divisions of Facebook and Google, AppsFlyer and Flurry. The order required Flo to obtain affirmative consent before sharing personal health information, notify affected users, and instruct third parties that had received the data to destroy it.

In 2023 the FTC brought an action against Easy Healthcare, which operates the Premom ovulation app. Easy Healthcare agreed to a $100,000 civil penalty for violating the Health Breach Notification Rule, was permanently barred from sharing users' personal health data with third parties for advertising, and was required to obtain consent before sharing it for other purposes.

Both companies had privacy policies. That is the part worth sitting with: the promise and the practice were different, and it took a regulator to establish that. A person deciding where to keep their own records cannot audit any of this from the outside.

What is worth writing down

Separate from where it lives, treatment generates a specific set of things worth keeping, and most of it is the kind of detail that is obvious at the time and gone three months later.

• Medications by cycle — name, dose, the date it started and stopped, and what changed from last time. Protocols get adjusted, and the previous protocol becomes the reference point.
• Monitoring visits — date, follicle counts, lining, and the lab values your clinic reports back.
• Costs and what was billed to whom. Fertility coverage is frequently partial, and the running total is otherwise impossible to reconstruct.
• Questions between appointments. The consultation is short and the list is what makes it useful.
• Dates that anchor everything else: retrieval, fertilization report, transfer, the beta and its repeat.
• Who said what. Across a clinic you will speak to several people, and the instruction you were given matters more than who gave it.

Where to keep it

The privacy question has a simple structural answer: keep the record somewhere with no ability to transmit it. A file on your own device cannot send your medication log to an analytics firm, because there is nothing in it that sends anything anywhere. That is not a promise about a company's conduct, which is what a privacy policy is — it is a property of the thing itself.

This is the same reasoning that applies to organizing documents privately inside a shared household, where the risk is not a company but a synced account that quietly copies to a second person's phone. In both cases the fix is a working space with no sharing surface rather than a stricter setting on a shared one.

It is also worth checking what a shared household account already syncs. A fertility log in a notes app, a photo of a lab result in a camera roll, or a calendar entry titled with a clinic name will follow whatever sync is switched on. The organizing habits in the first week after a diagnosis transfer directly here: one place, kept current, that you can hand to someone deliberately rather than by accident.

Common questions